Adding AD domain groups to /etc/sudoers

A recent discussion on the MacEnterprise list focused around how to give members of Active Directory groups the ability to run commands as root using the sudo command-line utility. This would allow the users in those groups the ability to run some or all commands with root privileges in Terminal without having to give those accounts administrative privileges on the Mac in question.

To do this, you would need to add an entry to the /etc/sudoers file. /etc/sudoers gives listed users or groups the ability to execute commands while having the privileges of the root user.

Editing /etc/sudoers

To edit /etc/sudoers safely, make sure to use the visudo utility. This application will do a sanity check on your changes to /etc/sudoers before putting them into production.

Adding the following entry to /etc/sudoers would allow you to give full sudo permissions to an AD group named ITadmins:

%DOMAIN\\ITadmins ALL=(ALL) ALL

Because a number of AD groups have spaces in the names, you’ll need to escape the spaces using backslashes. For example. adding the following entry to /etc/sudoers would allow you to give full sudo permissions to an AD group named Group Name With Spaces:

Any clues on how to speed up the sudo command (seems like it queries the entire active directory each time I run the command; makes it so slooooow)? Is there a way to tell winbind to only search one specific group and not entire directory (i.e. because only one specific (admin) group would ever be using ssh or console to my Debian servers)?

have fqdn in /etc/hosts and %groupname in /etc/sudoers

I’d be okay with locking people out of this box if it would help speed up that command